Reference
Security & threat model
What stealth wallets, splitting and jitter protect against, and what they do not.
This page is for a skeptical reader. It lists what the privacy layer is designed to stop, and where it stops.
What Zerohook is designed to hide
The link between you and your trades. With the private path, a tracker watching your public wallet does not see your swaps, positions or orders, because they run from single-use wallets funded by a relayer and settle back into a shielded balance.
What stays public
| Public | Why |
|---|---|
| Each trade: tokens, size, price, time | It is an on-chain swap. The market sees the trades |
| Your deposit into the shielded pool | It is sent from your public wallet |
| Withdrawals and their destination | They leave the pool on-chain |
| Ragequit exits | Ragequit is public by design |
| Recipients of private sends and payouts | Only the sender side is hidden |
| Execution quality | Proof of Execution pages are public on purpose |
What each layer protects against, and what it doesn't
Stealth wallets
- Protect against: following your wallet history, copy-trading from your wallet, watchlists on your address.
- Don't protect against: matching by amount or timing, or your own actions, such as sending output to a wallet known to be yours.
Amount splitter
- Protects against: matching a deposit to a withdrawal or buy by its exact size.
- Doesn't protect against: analysis of totals over time when the anonymity set is small.
Timing jitter
- Protects against: matching transactions that land close together.
- Doesn't protect against: patient analysis across many transactions, or trades you need filled immediately (no jitter possible).
Private RPC routing
- Protects against: public RPC endpoints logging your IP and node fingerprint next to your requests.
- Doesn't protect against: whoever operates the private route, or other apps on your device.
Shielded pool
- Protects against: reading your balance from a public address.
- Depends on: the size of the anonymity set. Privacy Pools v2 is chosen so users join one large set. Deployment on Robinhood Chain is still being verified on-chain.
Parties you trust
| Party | What you rely on it for | Status |
|---|---|---|
| Zerohook contracts | Correct handling of funds | Not audited yet |
| Privacy Pools v2 | Shielded pool and ragequit | Deployment on Robinhood Chain being verified on-chain |
| Association Set Provider | Screening at entry | Set by Privacy Pools, not Zerohook |
| Aave | Lending yield on idle balances | Deployment on Robinhood Chain being verified on-chain |
| Relayer | Funding stealth wallets | Sees the transactions it submits |
| The Zerohook app | Showing ghost positions as one portfolio | Knows which wallets are yours |
| AI model provider (agent mode) | Running your agent | Sees your prompts; does not learn your main wallet |
Execution risks
- Price movement and MEV. A stealth-wallet swap is still a public swap and can be front-run or sandwiched like any other. Hard limits cap slippage and guarantee a minimum received.
- Malicious hooks. Pinned contracts check known code before quoting. Known is not the same as audited.
- Failed routes. Route simulation keeps failing routes out of your wallet. It cannot predict state changes after the simulation.
Long-term risk
Shielded notes rely on today's proof systems. A future break, for example by quantum computers, could expose past activity. The post-quantum migration is a ROADMAP item, not live.
Good habits
- Don't send output directly to a wallet known to be yours.
- Avoid unique amounts. Let the splitter work.
- Don't trade the moment you deposit. Let jitter work.
- Read the Leak score before you sign.